CVE-2026-96775: MLflow dspy bypasses pickle deserialization control
Published Sep 23, 2026
·Updated
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
Affected Software
1 affected component
MLflow dspy flavor>=2.0
Event History
Sep 23, 2026
CVE Published
via MITRE·04:28 PM
Data Sourced
via MITRE·04:28 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to supply or cause use of a crafted MLmodel artifact. Successful exploitation can result in arbitrary code execution through unsafe deserialization.
2
Does setting MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False fully protect the dspy flavor?
No. In affected versions, the control is applied only when the model_path ends in .pkl, allowing crafted artifacts using other paths to bypass the restriction.
3
Which deployments should be prioritized for triage?
Prioritize MLflow deployments using the dspy flavor that load MLmodel artifacts from remote or otherwise untrusted sources. The issue affects dspy flavor versions 2.0 and later.